CVE-2026-59729: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/server/render/dom.ts, has its own inline attribute loop that does not go through addAttribute() and was not updated. It interpolates the attribute name unescaped and only escapes the value, so untrusted prop keys spread onto a native-HTMLElement-subclass component can still break out of the attribute context, resulting in XSS.
References
- github.com/advisories/GHSA-f48w-9m4c-m7f5
- github.com/withastro/astro/commit/5240e26c9dd91f9bc7140dcfacdb48d5a132830d
- github.com/withastro/astro/pull/17251
- github.com/withastro/astro/releases/tag/astro@7.0.6
- github.com/withastro/astro/security/advisories/GHSA-f48w-9m4c-m7f5
- nvd.nist.gov/vuln/detail/CVE-2026-59729
Code Behaviors & Features
Detect and mitigate CVE-2026-59729 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →